Anomaly Detection in IoT Networks: From Architectures to Machine Learning Transparency

Machine learning (ML) is becoming an integral part of networks security arsenal, where Internet of Things (IoT) structures play an increasingly important role. However, IoT networks have many specific requirements, mostly due to limited energy availability and stringent computing resources. This results in limitations for traditional ML approaches to security, in particular for anomaly detection. Consequently, new focuses for solutions that range from architectural to data processing ones are necessary. Therefore, appropriate lightweight ML algorithms have to be designed and deployed in appropriate architectural settings, which is the main contribution of this paper. In addition, insights into ML functioning are needed to better understand the observed anomalies. To enable these insights (and support a wider applicability of ML based approaches), the results have to be as explainable as possible. The research presented in this paper addresses this problem through the functional and data transparency of ML applications, tailored to the specifics of anomaly detection in IoT networks. To tackle accordingly also the architectural issues, the presented approach builds on the well-established layering principle from computer communications reference models. This principle not only supports flexibility but also increases security in these new environments of growing importance.